Your tax function appears to be working fine.
Returns are filed on time. Compliance deadlines are met. There are no penalties or audit notices. Leadership assumes tax is under control.
But you have no idea what you don’t know.
Most companies operate with tax exposures they don’t fully understand, vulnerabilities that aren’t visible until an auditor raises them or a buyer discovers them during due diligence. Audit risk. Nexus issues. Documentation gaps. Positions that aren’t well-supported. Transfer pricing arrangements that lack contemporaneous support.
None of these create immediate crises. But they’re all lurking, accumulating, waiting to surface at an inconvenient moment.
This is the gap between compliance and risk management. And it’s where many companies are dangerously exposed.
Compliance and risk management sound similar. In reality, they’re fundamentally different.
Compliance is backward-looking. It answers the question: “Are we meeting current obligations? Are filings accurate? Are we on time?”
Risk management is forward-looking. It answers: “What vulnerabilities might surface? What exposures do we carry? What could go wrong?”
Compliance is about doing what you’re required to do. Risk management is about identifying and mitigating what could hurt you.
Companies often assume that compliance coverage equals risk management. If you’re compliant, you’re safe. But that’s not how it works.
You can be perfectly compliant and still carry significant hidden exposures. Poor documentation on positions that are technically defensible. Intercompany arrangements that work operationally but lack transfer pricing support. Nexus situations you don’t fully understand. Positions taken on returns that are reasonable interpretations of the law but could be challenged.
Compliance says: “These filings are correct.” Risk management says: “But what about these positions? What happens if they’re challenged?”
Tax exposures accumulate quietly, often without anyone realizing they exist.
Entities transact regularly—management fees, cost allocations, IP licensing—but without proper documentation or transfer pricing support. These arrangements work operationally, but if audited, lack of contemporaneous documentation becomes a serious problem.
You operate in multiple states, but your nexus analysis is informal. You file where you think you should, but you’re not entirely certain. Meanwhile, exposures in states you didn’t think you had nexus are quietly accumulating.
You take positions on returns that seem reasonable, but if challenged, the supporting analysis is weak. You’re relying on the position not being questioned rather than being confident it would withstand scrutiny.
Tax law changes. You don’t always catch how changes affect your existing positions or structures. So you continue operating under outdated assumptions.
You acquire a company or consolidate operations, but tax structures aren’t evaluated holistically. Inefficiencies or exposures from the pre-integration structure persist.
Supporting documentation for deductions, credits, or positions is incomplete or disorganized. If questioned, you’d struggle to defend positions that might otherwise be defensible.
These exposures don’t create immediate problems. That’s why they’re dangerous. They’re invisible until an audit or due diligence surfaces them.
Exposures reveal themselves at inconvenient moments.
During audits: Tax authorities raise questions. Positions you thought were safe are challenged. Documentation that seemed adequate is found wanting. What you thought was compliance risk becomes actual exposure.
During M&A due diligence: Buyers conduct tax reviews. They identify documentation gaps, poorly-supported positions, or nexus issues. These become deal negotiation points. Valuations are adjusted. Escrows are increased.
During PE ownership: Private equity sponsors expect institutional-grade tax governance. Hidden exposures you didn’t think were significant get flagged. Remediation becomes urgent.
During capital raises: Investors conduct tax diligence. Risk factors that seemed minor suddenly matter. Exposures affect investor confidence and valuation.
During regulatory reviews: State or federal agencies conduct reviews. Hidden exposures become actual liabilities.
By the time exposures surface, it’s too late to prevent them. You’re managing the consequences, not the risk.
The hidden costs of poor tax risk management, and the strategic gaps that emerge when exposures aren’t proactively identified are covered in our article on the real cost of not having a tax leader, where the absence of risk-focused oversight creates vulnerabilities that compound over time.
Proactive tax risk management doesn’t require perfect knowledge of every tax rule. It requires intentional effort to identify and address likely exposures before they become problems.
Understand your current positions: What positions are you taking on returns? Which ones rely on interpretations that could be challenged? Which ones are well-supported, and which ones need better documentation?
Evaluate nexus across all jurisdictions: Which states do you actually have nexus in? Are you filing where you should? Are you missing obligations in states where you didn’t realize you had nexus?
Document intercompany transactions: If entities transact, ensure arrangements have contemporaneous documentation and transfer pricing support. Formalize policies. Ensure transactions are arm’s-length and defensible.
Review structures periodically: Your structures made sense when they were established. Are they still optimal? Are they still defensible? Do they create unnecessary complexity or exposure?
Organize and maintain records: Keep support for deductions, credits, and positions accessible and organized. If questioned, you can respond immediately rather than scrambling.
Stay current on regulations: When tax law changes, evaluate how changes affect your existing positions and structures. Don’t continue operating under outdated assumptions.
Coordinate with external advisors: If you work with CPA firms or tax attorneys, use them strategically. They can help identify exposures and evaluate risks.
Most of this work doesn’t require heroic effort. It requires someone with tax expertise thinking systematically about risk.
For many organizations, this is where fractional tax leadership makes an immediate impact. A fractional tax leader can assess your current risk profile, identify exposures, prioritize remediation, and ensure ongoing risk management becomes part of how your tax function operates.
The shift from operating with hidden exposures to proactively managing risk doesn’t happen with a single action.
But it starts with recognition: acknowledging that compliance and risk management are different, and that your organization needs both.
From there, you can begin systematic evaluation of your current exposures, prioritize the most significant ones for remediation, and build processes to ensure new exposures don’t accumulate.
By the time an audit or due diligence surfaces risk factors, the best ones should already be known to you – understood, documented, and strategically managed.
That’s the difference between hoping nothing gets questioned and knowing your tax position would withstand scrutiny.
*Koru Accountancy Corp provides fractional VP/Director of Tax leadership to growing and complex organizations. We specialize in embedding executive-level tax expertise directly into finance teams, supporting companies through growth, transition, and complexity.
To learn more, visit koruaccountancy.com.*
